Supply Chain Security KCSA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A Node.js application build broke because a transitive dependency was updated to a version with a known vulnerability. The team wants to ensure that builds are reproducible and that dependency versions are locked to known-good versions. Which practice should they adopt?

   • ADelete the lock file and rely on the package.json ranges to resolve dependencies.
   • BPin the exact version of the direct dependency in package.json and ignore transitive dependencies.
   • CCommit the package-lock.json file and use `npm ci` in the build pipeline.
   • DUse `npm update` in the build pipeline to always get the latest versions.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary goal of supply chain security in the Kubernetes and cloud native ecosystem?

   • ATo guarantee that applications are always available and can handle any level of traffic
   • BTo automatically patch all vulnerabilities in container images without human intervention
   • CTo provide a secure network connection between Kubernetes clusters and external services
   • DTo ensure that all software components and processes involved in delivering an application are trustworthy and free from tampering
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Why is supply chain security particularly important in the Kubernetes and cloud native ecosystem?

   • ABecause cloud providers are responsible for securing all application code
   • BBecause applications are composed of many third-party components and are deployed rapidly across distributed environments
   • CBecause Kubernetes clusters are always exposed to the public internet
   • DBecause container images are too large to be scanned manually
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the recommended way to handle secrets (e.g., API keys, passwords) in a CI/CD pipeline?

   • APass them as command-line arguments to every job
   • BStore them in a dedicated secrets management service and reference them via variables
   • CEmbed them directly in the pipeline configuration file
   • DEncrypt them with a static key stored in the same repository
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A developer is writing a web application that accepts user input and displays it on a page. To prevent cross-site scripting (XSS) attacks, which coding practice should the developer follow?

   • AValidate user input against a strict allowlist of allowed characters.
   • BDisable JavaScript in the user's browser.
   • CUse parameterized queries for all database access.
   • DEncode all user input before rendering it in the HTML output.
   Reveal Solution Discussion Select an answer first